MalwareRansomwareData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
The Athenian School
bd_ee7804c9cebc5b21 · schema v1 · pii pii-v1
Full breach record for The Athenian School →Athenian School reported a ransomware attack on third-party vendor Blackbaud occurring between Feb 7 and May 20, 2020. The attack resulted in the exfiltration of unencrypted personal information, including Social Security Numbers and names, from a backup file. Blackbaud paid a ransom and claimed to have destroyed the data, but Athenian issued notifications to affected individuals offering 24 months of credit monitoring and identity theft protection. Remediation includes encrypting SSN data and restricting storage of sensitive vendor data.
California clockDiscovered Jul 16, 2020 → Notified Sep 29, 202075d ✗ CA 60-day late15 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-195583
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 27, 2020
- Raw hash
- 30a6fd87c98611a629c0e04718488b7f79cdb6f33d051a11358ce8c3255c0db4
Reporting entity
- Name
- The Athenian Schoolnorm: the athenian school
- Domain
- athenian.org
Victim entity
- Name
- The Athenian Schoolnorm: the athenian school
- Domain
- athenian.org
Incident
- Discovered
- Jul 16, 2020
- Materiality determined
- —
- Notification sent
- Sep 29, 2020
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Submitted breach notification to California Office of the Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 15 weeks(103 days from discovery to filing)
- Compliance flags
- CA 60-day late · 75d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 16, 2020→ Notified: Sep 29, 202075d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.